An industrial control system network traffic baseline analysis method and system

Abstract

The application provides an industrial control system network flow baseline analysis method and system. The method comprises the following steps: extracting the industrial control network flow, connection five-tuple and industrial control protocol type and quantity in a current predefined time range as baseline detection objects; determining the monitoring period of the baseline according to the type of the baseline detection objects; determining whether the baseline needs to be updated according to the monitoring period by applying the sliding window method; updating the baseline by applying the sliding window method if the baseline needs to be updated; calculating the upper baseline threshold and the lower baseline threshold by the baseline if the baseline does not need to be updated; and judging whether the current industrial control network flow is abnormal according to the upper baseline threshold and the lower baseline threshold. The application can avoid the error caused by manual flow baseline adjustment, adjust the window size according to the actual business situation, automatically optimize the flow baseline, improve the applicability of the flow baseline and reduce the false alarm rate of the baseline detection.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a method and system for analyzing network traffic baseline of an industrial control system. Background Art

[0002] Industrial control systems are an important part of critical information infrastructure. With the vigorous development of various emerging businesses, channels have been established between industrial control systems and the Internet, resulting in frequent cyber attacks against industrial control systems in recent years. This has posed a serious cybersecurity threat to industries that rely on industrial control systems, such as energy, transportation, water conservancy, steel, and manufacturing.

[0003] Network traffic analysis is a key method for monitoring the security status of industrial control systems. Current network traffic analysis focuses on identifying traffic signatures of network attacks through methods such as signature matching. However, it is difficult to detect unknown attacks for which traffic signatures have not yet been extracted. Traffic baselines, on the other hand, characterize normal business traffic. By detecting the degree to which real-world network traffic deviates from the traffic baseline, attack events can be identified, effectively avoiding the problem of extracting traffic signatures for unknown attacks.

[0004] In the industrial control system security status detection technology based on flow baseline, the extraction of flow baseline is an important part. The extraction of traditional flow baseline generally relies on manual setting. After the flow baseline is determined, it is difficult to adjust, and even if it is adjusted, there is no basis. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention proposes a technical solution for an industrial control system network traffic baseline analysis method to solve the above technical problems.

[0006] A first aspect of the present invention discloses a method for analyzing network traffic baselines in an industrial control system, the method comprising:

[0007] Step S1: Collect historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities;

[0008] Step S2: Calculate the statistics of the historical industrial control network traffic to obtain the statistics of the historical industrial control network traffic, and obtain a baseline based on the statistics of the historical industrial control network traffic, the historical connection quintuples, and the historical industrial control protocol types and quantities;

[0009] Step S3: extracting the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within the current predefined time range as baseline detection objects;

[0010] Step S4: determining a baseline monitoring period according to the type of the baseline of the baseline detection object, and determining whether the baseline needs to be updated based on the monitoring period using a sliding window method;

[0011] Step S5: If the baseline needs to be updated, update the baseline using a sliding window method;

[0012] Step S6: If the baseline does not need to be updated, calculate an upper baseline threshold and a lower baseline threshold based on the baseline;

[0013] Step S7: Determine whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

[0014] According to the method of the first aspect of the present invention, in step S2, the historical industrial control network traffic statistics include:

[0015] The historical peak value of industrial control network traffic, the historical trough value of industrial control network traffic, the historical number of connections, and the historical data packet length of industrial control network traffic.

[0016] According to the method of the first aspect of the present invention, in step S2, the mean of the historical industrial control network traffic statistics, the mean of the historical common protocol type and quantity of the connection quintuples, and the mean of the historical industrial control protocol type and quantity are used as baselines.

[0017] According to the method of the first aspect of the present invention, in step S4, the method of applying a sliding window method to determine whether the baseline needs to be updated according to the monitoring period includes:

[0018] The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period;

[0019] In the nth monitoring period, the sliding window length is set to x;

[0020] Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range;

[0021] If the baseline of the nth type is within the monitoring baseline determination range, the baseline does not need to be updated; otherwise, it needs to be updated.

[0022] According to the method of the first aspect of the present invention, in step S5, the method of updating the baseline by applying the sliding window method includes:

[0023] The average value of the baseline within the predefined time range corresponding to the first x n-th monitoring periods is calculated, and the average value of the baseline is used as the updated value of the baseline.

[0024] According to the method of the first aspect of the present application, in the step S6, the calculation method of the upper baseline threshold comprises:

[0025] The upper baseline threshold = baseline × (1 + 3%).

[0026] According to the method of the first aspect of the present application, in the step S6, the calculation method of the lower baseline threshold comprises:

[0027] The lower baseline threshold = baseline × (1 - 3%).

[0028] The second aspect of the present application discloses an industrial control system network flow baseline analysis system, the system comprises:

[0029] A first processing module is configured to collect historical industrial control network flow, connection five-tuple and industrial control protocol type and quantity;

[0030] A second processing module is configured to calculate the statistical quantity of the historical industrial control network flow to obtain the statistical quantity of the historical industrial control network flow, and obtain the baseline according to the statistical quantity of the historical industrial control network flow, historical connection five-tuple and historical industrial control protocol type and quantity;

[0031] A third processing module is configured to extract the industrial control network flow, connection five-tuple and industrial control protocol type and quantity in a current predefined time range as a baseline detection object;

[0032] A fourth processing module is configured to determine the monitoring period of the baseline according to the type of the baseline of the baseline detection object, and determine whether the baseline needs to be updated by applying the method of the sliding window according to the monitoring period;

[0033] A fifth processing module is configured to update the baseline by applying the method of the sliding window if the baseline needs to be updated;

[0034] A sixth processing module is configured to calculate the upper baseline threshold and the lower baseline threshold by the baseline if the baseline does not need to be updated;

[0035] A seventh processing module is configured to determine whether the current industrial control network flow is abnormal according to the upper baseline threshold and the lower baseline threshold.

[0036] According to the system of the second aspect of the present application, the second processing module is configured to, the statistical quantity of the historical industrial control network flow comprises:

[0037] The peak value of the historical industrial control network flow, the trough value of the historical industrial control network flow, the historical connection number and the data packet length of the historical industrial control network flow.

[0038] According to the system of the second aspect of the present invention, the second processing module is configured to apply the mean of the historical industrial control network traffic statistics, the mean of the common protocol types and quantities of the historical connection quintuples, and the mean of the historical industrial control protocol types and quantities as baselines.

[0039] According to the system of the second aspect of the present invention, the fourth processing module is configured to determine whether the baseline needs to be updated by applying a sliding window method according to the monitoring period, including:

[0040] The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period;

[0041] In the nth monitoring period, the sliding window length is set to x;

[0042] Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range;

[0043] If the baseline of the nth type is within the monitoring baseline determination range, the baseline does not need to be updated; otherwise, it needs to be updated.

[0044] According to the system of the second aspect of the present invention, the fifth processing module is configured such that the updating of the baseline by applying the sliding window method includes:

[0045] The average value of the baseline within the predefined time range corresponding to the first x n-th monitoring periods is calculated, and the average value of the baseline is used as the updated value of the baseline.

[0046] According to the system of the second aspect of the present invention, the sixth processing module is configured to, in step S6, calculate the upper baseline threshold including:

[0047] Upper baseline threshold = baseline x (1 + 3%).

[0048] According to the system of the second aspect of the present invention, the sixth processing module is configured such that the method for calculating the lower baseline threshold comprises:

[0049] Lower baseline threshold = baseline x (1-3%).

[0050] A third aspect of the present invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the steps of any one of the industrial control system network traffic baseline analysis methods described in the first aspect of the present disclosure.

[0051] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the industrial control system network traffic baseline analysis methods of the first aspect of the present disclosure.

[0052] The proposed solution, by extracting network traffic baselines from industrial control systems, can detect attack events without relying on attack signatures. This effectively addresses advanced persistent attacks and unknown attacks, providing timely warnings of network security threats and enabling responsive measures to safeguard organizational network security. Furthermore, it can automatically adjust the traffic baseline based on the environment, avoiding errors caused by manual adjustments and enabling the baseline to adapt to changing traffic scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 Flowchart of a method for analyzing network traffic baseline of an industrial control system according to an embodiment of the present invention;

[0055] Figure 2 This is a structural diagram of an industrial control system network traffic baseline analysis system according to an embodiment of the present invention;

[0056] Figure 3 FIG. 4 is a structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0058] A first aspect of the present invention discloses a method for analyzing network traffic baseline of an industrial control system. Figure 1 FIG. 1 is a flow chart of a method for analyzing network traffic baseline of an industrial control system according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0059] Step S1: Collect historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities;

[0060] Step S2: Calculate the statistics of the historical industrial control network traffic to obtain the statistics of the historical industrial control network traffic, and obtain a baseline based on the statistics of the historical industrial control network traffic, the historical connection quintuples, and the historical industrial control protocol types and quantities;

[0061] Step S3: extracting the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within the current predefined time range as baseline detection objects;

[0062] Step S4: determining a baseline monitoring period according to the type of the baseline of the baseline detection object, and determining whether the baseline needs to be updated based on the monitoring period using a sliding window method;

[0063] Step S5: If the baseline needs to be updated, update the baseline using a sliding window method;

[0064] Step S6: If the baseline does not need to be updated, calculate an upper baseline threshold and a lower baseline threshold based on the baseline;

[0065] Step S7: Determine whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

[0066] In step S1, historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities are collected.

[0067] Specifically, the connection quintuple includes: IP address, source port, destination IP address, destination port and transport layer protocol.

[0068] In step S2, statistics of the historical industrial control network traffic are calculated to obtain statistics of the historical industrial control network traffic, and a baseline is obtained based on the statistics of the historical industrial control network traffic, historical connection quintuples, and historical industrial control protocol types and quantities.

[0069] In some embodiments, in step S2, the historical industrial control network traffic statistics include:

[0070] The historical peak value of industrial control network traffic, the historical trough value of industrial control network traffic, the historical number of connections, and the historical data packet length of industrial control network traffic.

[0071] The mean of historical industrial control network traffic statistics, the mean of historical connection quintuple common protocol types and numbers, and the mean of historical industrial control protocol types and numbers are used as baselines.

[0072] In step S3, the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within the current predefined time range are extracted as baseline detection objects.

[0073] Specifically, for the production control area, the type and quantity of industrial control protocols, as well as peak and valley values ​​of traffic, number of connections, and data packet length can be selected as the baseline detection object set:

[0074] Industrial control protocol baseline: B ics_pro_type ,B ics_pro_num ;

[0075] Traffic statistics baseline: B peak ,B off_peak ,B connection ,B packet_len；

[0076] Among them, B ics_pro_type Indicates the industrial control protocol type, B ics_pro_num Indicates the number of industrial control protocols, B peak Indicates the peak value of traffic, B off_peak Indicates the valley value of flow, B connection Indicates the number of connections, B packet_len Indicates the length of the data message;

[0077] For the management information area, you can select the connection quintuple, namely IP address, source port, destination IP address, destination port, and transport layer protocol, as well as traffic peak value, trough value, number of connections, and data packet length statistics as the baseline detection object set to establish:

[0078] Common Protocol Baseline: B pro_type ,B pro_num ;

[0079] Traffic statistics baseline: B peak ,B off_peak ,B connection ,B packet_len ;

[0080] Among them, B pro_type Indicates the general protocol type, B pro_num Indicates the number of common protocols.

[0081] In step S4, a monitoring period of the baseline is determined according to the type of the baseline of the baseline detection object, and a sliding window method is applied based on the monitoring period to determine whether the baseline needs to be updated.

[0082] In some embodiments, in step S4, the method of applying a sliding window method to determine whether the baseline needs to be updated according to the monitoring period includes:

[0083] The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period;

[0084] In the nth monitoring period, the sliding window length is set to x;

[0085] Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range, n∈{1,2,3,4}, x∈N;

[0086] Methods for obtaining monitoring baseline discrimination ranges include:

[0087] Calculate the mean of the baseline within the predefined time range corresponding to the first x nth monitoring periods to obtain the discriminant mean;

[0088] The monitoring baseline discrimination range includes an upper monitoring baseline discrimination range and a lower monitoring baseline discrimination range;

[0089] Upper monitoring baseline discrimination range = discrimination mean × (1 + 5%);

[0090] Lower monitoring baseline discrimination range = discrimination mean × (1-5%);

[0091] If the baseline of the nth type is within the monitoring baseline determination range, the baseline does not need to be updated; otherwise, it needs to be updated.

[0092] Specifically, for the production control area, for the industrial control protocol baseline, the third monitoring cycle can be selected because the industrial control protocol in the production control environment is relatively fixed and will not change significantly; for the traffic statistics baseline, in order to facilitate monitoring of sudden increases in traffic caused by attacks, malformed datagrams, etc., the fourth monitoring cycle can be selected.

[0093] The first monitoring cycle sets the sliding window length to 3; the second monitoring cycle sets the sliding window length to 4; the third monitoring cycle sets the sliding window length to 4; and the fourth monitoring cycle sets the sliding window length to 6.

[0094] For example, if the monitoring period in the third monitoring cycle is Monday, the traffic baseline in the sliding window should be the traffic baseline for Mondays in the previous four weeks. If the monitoring period in the fourth monitoring cycle is 21:00-22:00, the traffic baseline in the sliding window should be the traffic baseline for 21:00-22:00 in the previous six days.

[0095] In step S5, if the baseline needs to be updated, a sliding window method is applied to update the baseline.

[0096] In some embodiments, in step S5, the method of applying the sliding window method to update the baseline includes:

[0097] The average value of the baseline within the predefined time range corresponding to the first x n-th monitoring periods is calculated, and the average value of the baseline is used as the updated value of the baseline.

[0098] Specifically, for example, the object to be detected is the industrial control protocol baseline of the production control area T ics_pro_type ,T ics_pro_num The third monitoring cycle is taken as an example for explanation, where the sliding window is set to 4.

[0099] For the current production control area industrial control protocol baseline to be detected object T ics_pro_type ,T ics_pro_num , where T ics_pro_type , using set representation, if the current monitoring date is D n , Industrial Control Protocol Baseline B ics_pro_type ,B ics_pro_num According to D n-2 、D n-3 、D n-4 、D n-5 If the calculation is successful, the traffic baseline needs to be updated.

[0100] At this time, according to the sliding window, according to D n-1 、D n-2 、D n-3 、D n-4 Recalculate the traffic statistics baseline based on the monitored traffic. n-1 、D n-2 、D n-3 、D n-4 、D n-5 The mean of the baseline detection objects is calculated to obtain the industrial control protocol baseline B ics_pro_type ,B ics_pro_num . For T ics_pro_type ,It adopts set representation, so manual judgment is required when making adjustments.

[0101] The object to be detected is based on the statistical baseline of industrial control protocol traffic in the production control area (T peak ,T off_peak ,T connection ,T packet_len ) Take the third monitoring cycle as an example for explanation, where the sliding window is set to 6.

[0102] For the current traffic statistics baseline, the object to be detected (T peak ,T off_peak ,T connection ,T packet_len ), if the current monitoring period is H n , the traffic statistics baseline set is (Bpeak ,B off_peak ,B connection ,B packet_len ) According to H n-2 、H n-3 、H n-4 、H n-5 、H n-6 、H n-7 If the calculation is successful, it is determined that the traffic baseline needs to be updated.

[0103] At this time, according to the sliding window, according to H n-1 、H n-2 、H n-3 、H n-4 、H n-5 、H n-6 Recalculate the traffic statistics baseline based on the monitored traffic. n-1 、H n-2 、H n-3 、H n-4 、H n-5 、H n-6 The mean of the baseline detection objects is used to calculate the traffic statistics baseline (B peak ,B off_peak ,B connection ,B packet_len ).

[0104] In step S6, if the baseline does not need to be updated, an upper baseline threshold and a lower baseline threshold are calculated based on the baseline.

[0105] In some embodiments, in step S6, the method for calculating the upper baseline threshold and the lower baseline threshold includes:

[0106] Upper baseline threshold = baseline × (1 + 3%);

[0107] Lower baseline threshold = baseline x (1-3%).

[0108] Specifically, for the baseline detection objects such as the peak value and the valley value of the flow, the peak value baseline B of the flow in the flow statistical baseline is used. peak For example, set T threshold_low =B peak ×(1-3%), T threshold_high =B peak ×(1+3%) T threshold_high Indicates the upper baseline threshold of the peak value, T threshold_low Represents the lower baseline threshold for the peak value.

[0109] In step S7, it is determined whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

[0110] Specifically, if the current flow is within the baseline threshold T threshold_low 、T threshold_high If the current flow rate is greater than T threshold_high or less than T threshold_low , that is, if it exceeds the baseline threshold, it is determined to be abnormal traffic and further attack response and disposal are required.

[0111] For example, for the production control area, if the industrial control protocol type baseline in the industrial control protocol baseline of the area is IEC 104 protocol, but in the actual industrial control protocol type T pro_type If the Modbus protocol appears in the data flow, it can be judged that the traffic is abnormal;

[0112] For the management information area, if the area has a high traffic peak value T during non-working days and non-working hours peak If the threshold is exceeded, the traffic can be judged as abnormal.

[0113] In summary, the proposed solution can detect attack events by extracting network traffic baselines from industrial control systems without relying on attack signatures. This effectively addresses advanced persistent attacks and unknown attacks, providing timely warnings of network security threats and enabling responsive measures to safeguard organizational network security. Furthermore, the solution can automatically adjust the traffic baseline based on the environment, avoiding errors caused by manual adjustments and enabling the baseline to adapt to changing traffic scenarios.

[0114] A second aspect of the present invention discloses an industrial control system network traffic baseline analysis system. Figure 2 FIG. 1 is a structural diagram of an industrial control system network traffic baseline analysis system according to an embodiment of the present invention; FIG. Figure 2 As shown, the system 100 includes:

[0115] The first processing module 101 is configured to collect historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities;

[0116] The second processing module 102 is configured to calculate statistics on the historical industrial control network traffic to obtain historical industrial control network traffic statistics, and obtain a baseline based on the historical industrial control network traffic statistics, historical connection quintuples, and historical industrial control protocol types and quantities;

[0117] The third processing module 103 is configured to extract the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within a current predefined time range as baseline detection objects;

[0118] The fourth processing module 104 is configured to determine a baseline monitoring period according to the type of the baseline of the baseline detection object, and determine whether the baseline needs to be updated based on the monitoring period by applying a sliding window method;

[0119] The fifth processing module 105 is configured to update the baseline using a sliding window method if the baseline needs to be updated;

[0120] A sixth processing module 106 is configured to calculate an upper baseline threshold and a lower baseline threshold based on the baseline if the baseline does not need to be updated;

[0121] The seventh processing module 107 is configured to determine whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

[0122] According to the system of the second aspect of the present invention, the second processing module 102 is configured such that the historical industrial control network traffic statistics include:

[0123] The historical peak value of industrial control network traffic, the historical trough value of industrial control network traffic, the historical number of connections, and the historical data packet length of industrial control network traffic.

[0124] According to the system of the second aspect of the present invention, the second processing module 102 is configured to apply the mean of the historical industrial control network traffic statistics, the mean of the common protocol type and quantity of the historical connection quintuples, and the mean of the historical industrial control protocol type and quantity as a baseline.

[0125] According to the system of the second aspect of the present invention, the fourth processing module 104 is configured to determine whether the baseline needs to be updated by applying a sliding window method according to the monitoring period, including:

[0126] The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period;

[0127] In the nth monitoring period, the sliding window length is set to x;

[0128] Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range;

[0129] If the baseline of the nth type is within the monitoring baseline determination range, the baseline does not need to be updated; otherwise, it needs to be updated.

[0130] According to the system of the second aspect of the present invention, the fifth processing module 105 is configured such that the updating of the baseline by applying the sliding window method includes:

[0131] The average value of the baseline within the predefined time range corresponding to the first x n-th monitoring periods is calculated, and the average value of the baseline is used as the updated value of the baseline.

[0132] According to the system of the second aspect of the present invention, the sixth processing module 106 is configured to, in step S6, calculate the upper baseline threshold by:

[0133] Upper baseline threshold = baseline x (1 + 3%).

[0134] According to the system of the second aspect of the present invention, the sixth processing module 106 is configured to calculate the lower baseline threshold by:

[0135] Lower baseline threshold = baseline x (1-3%).

[0136] A third aspect of the present invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the steps of any one of the industrial control system network traffic baseline analysis methods disclosed in the first aspect of the present invention.

[0137] Figure 3 FIG. 1 is a structural diagram of an electronic device according to an embodiment of the present invention. Figure 3 As shown, the electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, near field communication (NFC) or other technologies. The display screen of the electronic device can be a liquid crystal display or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the electronic device housing, or an external keyboard, touchpad or mouse.

[0138] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a structural diagram of the part related to the technical solution of the present disclosure, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0139] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods for analyzing network traffic baselines of an industrial control system disclosed in the first aspect of the present invention.

[0140] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above embodiments only express several implementation methods of the present application. The description is relatively specific and detailed, but it cannot be understood as a limitation on the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of this application, several variations and improvements can be made, which all fall within the scope of protection of this application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A method for analyzing network traffic baseline of an industrial control system, characterized in that: The method comprises: Step S1: Collect historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities; Step S2: Calculate the statistics of the historical industrial control network traffic to obtain the statistics of the historical industrial control network traffic, and obtain a baseline based on the statistics of the historical industrial control network traffic, historical connection quintuples, and historical industrial control protocol types and quantities; Step S3: extracting the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within the current predefined time range as baseline detection objects; Step S4: determining a baseline monitoring period according to the type of the baseline of the baseline detection object, and determining whether the baseline needs to be updated based on the monitoring period using a sliding window method; Specific update methods include: The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period; In the nth monitoring period, the sliding window length is set to x; Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range; If the baseline of the nth type is within the monitoring baseline discrimination range, the baseline does not need to be updated; otherwise, it needs to be updated; Step S5: If the baseline needs to be updated, update the baseline using a sliding window method; Step S6: If the baseline does not need to be updated, calculate an upper baseline threshold and a lower baseline threshold based on the baseline; Step S7: Determine whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

2. The method for analyzing network traffic baseline of an industrial control system according to claim 1, characterized in that: In step S2, the historical industrial control network traffic statistics include: The historical peak value of industrial control network traffic, the historical trough value of industrial control network traffic, the historical number of connections, and the historical data packet length of industrial control network traffic.

3. The method for analyzing network traffic baseline of an industrial control system according to claim 1, characterized in that: In step S2, the mean of the historical industrial control network traffic statistics, the mean of the historical common protocol type and quantity of the connection quintuples, and the mean of the historical industrial control protocol type and quantity are used as baselines.

4. The method for analyzing network traffic baseline of an industrial control system according to claim 1, characterized in that: In step S5, the method of updating the baseline by applying the sliding window method includes: The average value of the baseline within the predefined time range corresponding to the first x n-th monitoring periods is calculated, and the average value of the baseline is used as the updated value of the baseline.

5. The method for analyzing network traffic baseline of an industrial control system according to claim 1, characterized in that: In step S6, the method for calculating the upper baseline threshold includes: Upper baseline threshold = baseline x (1 + 3%).

6. The method for analyzing network traffic baseline of an industrial control system according to claim 1, characterized in that: In step S6, the method for calculating the lower baseline threshold includes: Lower baseline threshold = baseline x (1-3%).

7. A network traffic baseline analysis system for industrial control systems, characterized in that: The system comprises: The first processing module is configured to collect historical industrial control network traffic, connection quintuples, and industrial control protocol types and quantities; a second processing module configured to calculate statistics on the historical industrial control network traffic to obtain statistics of the historical industrial control network traffic, and obtain a baseline based on the statistics of the historical industrial control network traffic, historical connection quintuples, and historical industrial control protocol types and quantities; The third processing module is configured to extract the industrial control network traffic, connection quintuples, and industrial control protocol types and quantities within a current predefined time range as baseline detection objects; A fourth processing module is configured to determine a baseline monitoring period according to the type of the baseline of the baseline detection object, and determine whether the baseline needs to be updated based on the monitoring period by applying a sliding window method; Specific updates include: The first type of baseline has a monthly monitoring period, which is defined as the first monitoring period; the second type of baseline has a weekly monitoring period, which is defined as the second monitoring period; the third type of baseline has a daily monitoring period, which is defined as the third monitoring period; the fourth type of baseline has an hourly monitoring period, which is defined as the fourth monitoring period; In the nth monitoring period, the sliding window length is set to x; Calculate the baseline within the predefined time range corresponding to the first x nth monitoring cycles to obtain the monitoring baseline discrimination range; If the baseline of the nth type is within the monitoring baseline discrimination range, the baseline does not need to be updated; otherwise, it needs to be updated; A fifth processing module is configured to update the baseline using a sliding window method if the baseline needs to be updated; A sixth processing module is configured to, if the baseline does not need to be updated, calculate an upper baseline threshold and a lower baseline threshold based on the baseline; The seventh processing module is configured to determine whether the current industrial control network traffic is abnormal based on the upper baseline threshold and the lower baseline threshold.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps of the industrial control system network traffic baseline analysis method described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the industrial control system network traffic baseline analysis method described in any one of claims 1 to 6 are implemented.

Images